The functional area of Compliance and Risk Management covers a whopping 25 percent of the Associate Professional in Human Resources (aPHR) exam. Although that number might seem overwhelming as you near the end of this book, you have already covered much of the content in this functional area in Chapter 2. This chapter will reinforce the federal laws that apply to each of the major functional areas in the aPHR exam. It will also cover workplace safety and other business risks. When you are on the job and there is a safety problem, accidental injury, or death, you need to know what to do without spending a lot of time looking up the protocols. In addition, you must know how to complete all the required reports.

The Body of Knowledge (BoK) statements outlined by HR Certification Institute (HRCI) for the Compliance and Risk Management functional area by those performing early-career HR roles are as follows:

Knowledge of

•   01  Applicable laws and regulations related to talent acquisition, training, and employee/employer rights and responsibilities, such as nondiscrimination, accommodation, and work authorization; for example, EEOC, DOL, I-9 form completion, employment-at-will, Title VII, ADA, Immigration Reform and Control Act, Title 17 (copyright law)

•   02  Applicable laws, regulations, and legal processes affecting employment in union environments; for example, WARN Act, NLRA, collective bargaining, and alternative dispute resolution methods

•   03  Applicable laws and regulations related to compensation and benefits, such as monetary and non-monetary entitlement and wage and hour standards; for example, ERISA, COBRA, FLSA, USERRA, PPACA, and tax treatment

•   04  Applicable laws and regulations related to workplace health, safety, security, and privacy; for example, OSHA, Drug-Free Workplace Act, ADA, HIPAA, Sarbanes-Oxley Act, WARN Act, and sexual harassment

•   05  Risk assessment and mitigation techniques to promote a safe, secure, and compliant workplace; for example, emergency evacuation procedures, violence, business continuity plan, intellectual and employee data protection, and theft

•   06  Organizational restructuring initiatives and their risks to business continuity; for example, mergers, acquisitions, divestitures, integration, offshoring, downsizing, and furloughs

Laws and Regulations

Knowledge of federal laws is a significant part of the aPHR certification exam. We described federal employment laws in Chapter 2 and also noted them at the beginning of each functional area to help reinforce them throughout this book. The number of laws can certainly be overwhelming, but it becomes easier when you get a chance to apply them on the job.

Use this section as another opportunity to reacquaint yourself with federal employment laws, and continue to refer back to Chapter 2 and the beginning of each chapter for more detail on each law. Remember, practice makes perfect. The more you can familiarize yourself with these laws and think about how they will apply to your organization, or even companies you read about in the news, the easier they will be to remember on the exam.

Table 7-1 outlines the most common federal laws that apply to employment for private employers, including a brief explanation of how each law is related. The explanations in this table are intended to be brief, so don’t forget to review Chapter 2 for more detail.

Table 7-1  Common Federal Laws Related to Employment

In addition to federal laws covering employment, there are state laws and federal agencies that will frequently impact HR responsibilities in these areas. A few key examples are noted in the sections that follow.

Employment-at-Will

Currently, employment-at-will exists in most states, and it is state law that usually governs these employee relationships. Employment-at-will means that unless there is an agreement to the contrary, employment can be terminated by either the employee or the employer at any time, for any reason.

Employment-at-will only exists in the absence of a contract that details the employment agreement between employer and employee. Those contracts can be related to a group, such as union memorandums of understanding, or to individuals, such as chief executive officers.

Equal Employment Opportunity Commission (EEOC)

The EEOC is a federal agency that was established by the Civil Rights Act of 1964. It is responsible for enforcing laws against employment discrimination and has offices in each state. Also, because sexual harassment is not defined under a specific federal law, it has provided much of the guidance (in addition to case law) that impacts rules against sexual harassment in the workplace.

The EEOC is responsible for three main things: investigating and resolving discrimination complaints, gathering and compiling statistical information, and running educating and outreach programs to help employers avoid illegal discrimination. In the fiscal year 2020, the EEOC received 67,448 charges of workplace discrimination and secured $439.2 million for victims of discrimination.¹ The agency also oversees EEO-1 reporting for employers with 100 or more employees or federal contracts totaling $50,000 or more.

Department of Labor (DOL)

The DOL enforces over 180 federal laws.² These laws range from safety and wage and hour standards to unemployment and reemployment. For any laws enforced by the agency that have poster requirements, the DOL provides free copies of required posters in multiple languages. They can be accessed through their eLaws resource at https://webapps.dol.gov/elaws/.

The DOL has the authority to investigate and penalize employers for violations of federal law. Penalties for legal violations are adjusted regularly for inflation and can surpass $100,000 for willful or repeated violations of certain laws.³ Some states also have state labor agencies that administer state laws.

Labor Unions

In some organizations, groups of employers are represented by a labor union. All people were granted the right to form a union with the passing of the National Labor Relations Act (NLRA) in 1935 (see Chapter 2). The union is responsible for protecting the rights of the employees in the group it serves. For example, there are unions protecting occupations ranging from teachers to mine workers.

NLRB Procedures for Recognizing a Union

A specific process is required to form a union that is governed by the National Labor Relations Board (NLRB):

1.   The NLRB receives a petition from a labor organization for specific bargaining unit certification. The union petition must demonstrate a “show of interest” from at least 30 percent of employees it wishes to organize into a collective bargaining unit. This show of interest is usually in the form of authorization cards the union asks employees to sign saying they would like that union to represent them.

2.   If accepted by the NLRB, the employer may consent by voluntary agreement or request a hearing and election.

3.   The NLRB conducts a hearing to determine the legitimacy of the election request. It determines the scope of the voting unit and whether it’s a reasonable and appropriate group for collective bargaining. A bargaining unit is an employee group that shares a community of interest. Factors impacting that community of interest include the following:

•   Common supervision

•   Similar wages, benefits, and working conditions

•   Similarity of skills

•   Business operations in common

Each side (employer and union) may call or subpoena witnesses to testify during the hearing.

4.   Next comes a pre-election campaign by union and employer. A period of 25 to 30 days is normally allowed after the hearing decision for each side to try to convince employees of its viewpoint. The employer must provide to the NLRB an alphabetized list of employee names and home addresses who will be eligible to vote in the election. The agency will forward that list to the union so it can contact employees if it chooses to do so. That list is called an “Excelsior List” based on the NLRB case that first required employers to offer it. Employers may actively campaign against union representation, even using company time and facilities to do so. Employers are not required to provide union representatives an opportunity to attend those sessions, or even access to company property to refute those employer meeting presentations. All campaigning must end at least 24 hours prior to the election date as required by the NLRB 24-hour rule.

5.   “Blocking Charges” and charges of unfair labor practices can be filed with the NLRB by either the union or the employer. The pre-election process will be suspended while the NLRB investigates and rules on the charges. Once charges are resolved, the pre-election campaign clock can begin ticking again.

6.   The NLRB conducts the election. All managers and supervisors must stay away from the location where voting takes place on election day. They are not permitted to intimidate employees during the election process. People permitted at the voting location include the NLRB agent conducting the election, employee voters, one or more non-supervisory observers chosen by the employer, and the same number of observers chosen by the union. Only employees who are determined to be in jobs within the bargaining unit are eligible to vote.

7.   Either the union is elected to represent the bargaining unit or it is not (union election requires 50 percent plus one vote). The NLRB counts the votes and makes its announcement about the outcome.

Collective Bargaining

Collective bargaining is a process of negotiation that is required by the National Labor Relations Act (NLRA). Once an election has resulted in a union being certified as the representative of a work group, the next step is to develop a written contract that will lay out all the working conditions appropriate to the relationship and the work group requirements.

Contract Negotiation

Negotiating a contract requires identifying the subjects to be addressed by the agreement. Then, each party prepares its preferred position on each subject. The process of comparing those positions then begins. Often, dollars are attached to contract subjects. For example, the length of work shift, the amount of overtime to be paid, and the cost of healthcare benefits all can be represented by dollar values. If the union wants greater benefits for its members, a dollar value can be assigned to that increase. Employers argue budget restraint and use dollar values to justify their reasoning.

Establishing Contract Costs

Each component of a contract agreement can be assigned a cost in dollars. Adding all of those component costs can produce the total contract value. For example, health benefits will cost several hundreds of dollars each month to cover an employee and family members. The employer can agree to cover a percentage of that cost, with the balance being paid by the employee. A union will ask for more employer contribution to that formula. And, should the employer agree, the increased contribution can be assigned an incremental cost increase value. Adding that to other cost increases, such as increased pay schedules and overtime rates, will produce a total increase of contract costs. Each time a new proposal is made or received, a cost analysis should be made to determine the budgetary impact. Some costs will be perpetual, such as an increase in pay rates. Other costs can be limited to one time only, such as special bonus payments. There are advantages and disadvantages to costs that will be contained to one period of time (year) versus continuing into future periods of time.

Administering Union Contracts (MoU or CBA)

The thought that only large employers have union contracts is a myth. Many small employers work with union agreements. That is often the case in the construction industry, for example. Operating Engineers, Teamsters, and Laborers, among other unions, will sometimes have agreements with governmental entities that only union-represented workers will be employed on projects funded by that entity. This is common practice for cities and counties, particularly in geographical areas where labor organizations are a strong political influence.

Memoranda of understandings (MOUs) and collective bargaining agreements (CBAs) are the written contracts between employer and unions. MOU is a term usually found in the public sector, and CBA is a term normally used in the private sector.

Whether the employer is large or small, someone in the organization must be assigned the responsibility for coordinating work through unions and ensuring the employer abides by all requirements of the union contract. Sometimes, unions require that they process all job requisitions from their employer counterparts. Hiring through union “hiring halls” is the practice of notifying the union of a job opening and receiving a qualified union member as the new hire designee. It is a simple process that can provide staffing quickly, often with only one telephone call or e-mail with the employment requisition.

Large employers will have labor relations staff groups that are assigned responsibility for day-to-day interactions with labor unions, as well as carrying responsibility for contract negotiations. Small employers will rely on a part-time job duty assignment for the labor relations function because it doesn’t require full-time attention. Small employers sometimes rely on their labor attorneys to fill the role of contract negotiator and grievance handler, while job requisitions are processed part time by another company employee.

Unfair Labor Practices

The National Labor Relations Act (NLRA) explains that unfair labor practices can be blamed on either employers or labor unions. Common among issues evoking such claims are those revolving around the process of union elections. Unions commonly claim the employer is blocking their organizing efforts, and employers claim that the union is harassing employees and electioneering using paid time. Another issue that generates great numbers of complaints is how management and union members behave during a work stoppage (strike).

Complaints of unfair labor practices are formally filed with the National Labor Relations Board (NLRB). The NLRB will investigate the complaints and issue a determination along with any order for corrective action or limitation on activities of the offending party.

In some instances, when an employer believes there has been a violation of civil law requirements, it will go directly to court, requesting an injunction against the union to prevent the behavior that is causing the problem. That is common when striking union pickets block access to parking lots, loading docks, or employee building entrances. Municipal laws in many locations govern how public access to property must be maintained and how public sidewalks and roadways can be used appropriately.

In other instances, unions can seek court assistance when employers are being accused of inappropriate controls on picketers. Use of physical force by private security guards could be an example.

In either situation, the remedy sought through the court is an injunction preventing the offending behaviors. With an injunction in hand, it is possible to request help from law enforcement bodies such as the police department or sheriff’s department to enforce the injunction.

Complaint/Grievance Handling

Employee grievances can relate to any subject but always indicate a feeling of upset or discontent about something going on in the workplace, such as the way they are being treated, organizational policies, and the big category of “fairness.”

In union-represented organizations, the union contract (MOU or CBA) will usually explain what steps exist in the grievance procedure. They are designed to permit union members the opportunity to formally protest application of any contract provision. Most will deal with working conditions such as hours of work, how shifts are assigned, or seniority practices.

Here are the typical grievance handling steps you will find in most union policies:

1.   Written grievance submission  The employee describes in writing what is causing the upset or discontent.

2.   Grievance review  The grievance is reviewed by the employee’s supervisor and union representative to determine if it is valid.

3.   Grievance escalation  If the grievance cannot be resolved at the first stage, the union contract will usually designate higher levels of employer management and union representatives that must attempt to resolve the issue.

3.   Arbitration  If the grievance continues to be unresolved, many union contracts dictate that an outside arbitrator be called in to resolve the issue.

Mediation and Arbitration (Alternative Dispute Resolution, or ADR)

Mediation and arbitration are alternative methods for dispute resolution. Some employers require one or the other in lieu of lawsuits to resolve employment problems with workers. Each requires certification by a national or state board and also requires compliance with strict ethical standards.

Mediation is the less formal of the two problem-solving methods. Since 1995, the American Arbitration Association (www.adr.org) has used a Due Process Protocol that requires fair hearing of an issue. Mediation is usually not binding on the parties involved. That means employers and employees can go through the process, arrive at a conclusion, and still not accept it, though why that would happen seems odd.

Arbitration is a stricter alternative. It is usually binding on the parties because they accept that condition before the process begins. Arbitration is nearly always conducted by an arbitrator who is a neutral party and a member of the American Arbitration Association. Binding arbitration is sometimes used as an alternative to lawsuits because the expense is considerably less than court and attorney costs, and it can be quicker.

Cost of mediation or arbitration is often split equally by the parties, although it is possible for the employer to agree to accept responsibility for paying all costs involved. In union contracts, there is frequently a provision that costs will be split between the union and the employer. The method for selecting an arbitrator is usually specified in a union contract when that step is included in the grievance-handling process.

Risk Mitigation

The HR department is responsible for controlling the risk of financial loss due to safety and health issues in the workplace. Mitigation means to lessen in severity. The following sections cover the key areas in which HR professionals focus their efforts in this regard.

Injury and Illness Prevention Plan (IIPP)

Injury and illness prevention plans (IIPPs) are not mandated by OSHA. However, some states do require employers to use them. OSHA endorses the application of IIPPs in every workplace. An IIPP is a means of communicating hazards in the workplace and how to handle them. Key elements of an IIPP include management roles and responsibilities for workplace safety, worker participation, hazard identification, hazard prevention and control, education and training, and program evaluation and improvement.

Twenty-four states require IIPPs for some or all employers.⁴ When states have adopted such programs, they have experienced a decrease in injuries and illnesses, as well as financial benefits. Here are a few examples:

•   Alaska had an IIPP requirement for more than 20 years (1973 to 1995). Five years after the program was implemented, the net decrease in injuries and illnesses (the statewide reduction in injuries and illnesses over and above the national decrease during the same time period) for Alaska was 17.4 percent.

•   California began to require IIPPs in 1991. Five years after this requirement began, California had a net decrease in injuries and illnesses of 19 percent.

•   Colorado has a program that allows firms to adopt basic IIPP components in return for a workers’ compensation premium reduction. The cumulative annual reduction in accidents was 23 percent, and the cumulative reduction in accident costs was between 58 and 62 percent.

•   Hawaii began to require employers to have IIPPs in 1985. The net reduction in injuries and illnesses was 20.7 percent.

•   Massachusetts workers’ compensation program firms receive a premium credit for enrolling in a loss management program. In the first year of this program, firms participating in the program had a 20.8 percent improvement in their loss ratios.

•   North Dakota has a component under its workers’ compensation program for employers who have a risk management plan. The incentive is a 5 percent discount on annual workers’ compensation premiums. These risk management programs contain many of the elements of an injury and illness prevention program. They resulted in a cumulative decline for serious injuries of 38 percent over a 4-year period.

•   Texas had a program under its workers’ compensation commission from 1991 to 2005 that identified the most hazardous workplaces. Those employers were required to develop and implement IIPPs. The reduction in injuries over a 4-year period (1992 to 1995) averaged 63 percent each year.

•   Washington began requiring establishments to have IIPPs in 1973. Five years later, the net decrease in injuries and illnesses was 9.4 percent.

Identification of Risks/Dangers

A basic tenant of any safety program is workplace inspection. Identifying hazards, safety issues, and behavior problems that can cause injury are the result of such inspections. Once problems are identified, employees can be coached in how to change the way they behave in their workplace so the hazard can be reduced or eliminated. An example is leaving file cabinet drawers open after adding or removing documents. The potential for someone to walk into the open drawer is high when the cabinet is in the center of the workgroup. Opening more than one drawer at a time is another behavior problem that can result in the file cabinet tipping over onto the user.

Figure 7-1 is an example of a simple safety inspection form.

Figure 7-1  Sample Office Safety Inspection Form

Emergency Evacuation

One important provision of any safety plan is the preparation of emergency evacuation procedures. Employees must understand where the nearest exits are and what alternate exits are available in case the primary route out of the building is blocked. In addition, they need to know where to reassemble outside the building so the emergency operations officer can be sure everyone is safely away from the hazard.

Emergency Medical Care

When you’re creating an emergency plan, considering emergency medical care is a key element. It is nice when a call to 911 will garner ambulance dispatch, but what if you can’t reach 911 or there are no ambulances available when you call? Alternative plans must be made for treating and transporting injured workers to a medical facility where they can receive proper treatment.

Workplace Violence

A growing problem in this country is workplace violence. Everything in this category can cause trauma, physical or emotional. Consider how you will handle issues involving an employee who is upset and yelling at others in the workplace. What about a former employee who feels disrespected and returns to the workplace intent on killing someone? What about people who enter the workplace with weapons to take away valuable property? Any or all of these situations should be on your list of potential workplace violence incidents for which plans should be made.⁵

Health and Safety Monitoring

Human resource professionals are in a unique position to monitor employee health and safety. They usually have access to attendance reports and can identify patterns in employee wellness or illness. They can also detect issues with employee safety that occur in more than one supervisory unit. Perhaps the safety concerns span multiple work shifts within the same unit. Whatever the issue, human resource professionals should identify it and begin interventions that can mitigate the problems.

Workplace Safety Inspections

A key activity in preventing safety (and health) hazards is an active inspection program that covers all areas of the workplace. That means production facilities, office facilities, loading facilities, and shipping facilities. No location within the workplace should be exempt, and the inspections should be conducted on a regular basis. Often organizations find it helpful to apply a quarterly schedule; sometimes monthly inspections are more appropriate. It depends on how high a risk the work location faces. The higher the risk, the more frequent the inspections should be.

Handling Workplace Violence

All employees should be trained in recognizing and handling workplace violence problems. Supervisors must be trained in how to respond to workplace violence behavior and when to sound an alarm to other employees. There needs to be a management person appointed as the emergency response officer who will be responsible for talking with the media when that becomes necessary and for collecting information that can be passed on to senior management on a regular basis until the emergency has ended.

Handling Emergencies

When emergencies occur, employees need to understand how to respond. There should be some employees trained in first aid so they can provide preliminary treatment to people who have been injured. There should be some people designated to secure the facility by locking doors and closing other access points. Someone should be designated to contact law enforcement or emergency services (fire and paramedics) so employees and others can receive proper treatment. Someone should be designated as the spokesperson for media contacts and senior management briefings. Proper safety training for employees and supervisors can go a long way toward reducing injuries and achieving the appropriate emergency response when it is needed.

Business Continuity

Another important consideration is how business will continue after an emergency occurs. First, an organization must consider how to continue business in the short term by asking questions such as the following: Is it possible to keep the business open? If so, can all departments operate, or just a few? How can we keep revenues up and expenses down? Where will employees work and what changes should customers expect?

Determining the answer to all these questions is essential in preparing for an emergency. Most organizations were faced with these challenges during the COVID-19 pandemic in one form or another. However, according to a survey by Gartner, only 12 percent of employers were highly prepared for the impact of COVID-19.⁶

Workforce Restructuring

Sometimes, a long-term change in the organization is required, not just a short-term one. A workplace restructure is when an organization changes its business structure in some fashion. This can happen for many reasons. It can be a result of two or more organizations joining together, known as a merger, or one organization buying another organization, known as an acquisition. If an organization is in financial distress, it may need to reorganize or reduce internal staff to meet financial obligations. This can happen in the form of a divestiture, which is when an organization sells all or part of its business. Alternatively, an organization may decide to move operations to a different country, which is known as offshoring.

The list of reasons for why a restructure might occur are endless, but one thing that is consistent across the board is the importance of HR’s involvement in the restructure process. Whether an organization is growing, downsizing, or moving, there are risks associated with these changes that must be managed.

Mergers and Acquisitions

Mergers and acquisitions (M&As) require blending the workforces of two or more organizations. Sometimes that happens quickly, and sometimes it takes years. The United Airlines and Continental Airlines merger is an example of long-term adjustment to a merger.

The unfortunate reality is that an estimated 70 to 90 percent of all M&As fail to achieve their anticipated strategic and financial objectives.⁷ Oftentimes, this is a result of HR-related factors. Combining workplaces, overhauling policies and benefits programs, retraining, and adding or reducing staff members are difficult and sensitive processes. But most notably, change is difficult for people. During M&As, employees experience mixed emotions. Excitement, fear, anger, and uncertainty are only a few. That is why there is an entire HR function called change management dedicated to it. We reviewed change management in Chapter 4.

Government Approval  Sometimes it is necessary to obtain government approval for mergers and acquisitions. The United Airlines and Continental Airlines merger is one example. Another is AT&T’s purchase of Dish Network. In each case, government agencies needed to review the plans to be sure there would not be a violation of the Sherman Antitrust Act or other federal law.

Blending Policies and Culture  Far more difficult than signing an agreement to merge, the actual implementation requires cultures and policies to be merged. How will union representation be determined? Which policy will prevail when there are two different policies for a given topic? How will a culture of generous work scheduling support be blended with a culture of strict scheduling rules? Those are all difficult questions to resolve.

Duplicate Workforce  When NationsBank purchased Bank of America in 1998, there were a great many duplicate jobs in the headquarters organization. How can duplicate accounting personnel be reconciled with the ongoing needs for accounting workers? What happens when there are two bank branches just down the street from one another and the market can’t support more than one? Duplicate workforce can be absorbed over time by placing surplus employees in other job openings that need filling. It may also involve downsizing.

Offshoring

Over the years, it has become increasingly popular to move business to another location, often to obtain a cost savings. When business is moved to another country, it is called offshoring. This decision is commonly made when the cost of operations or the cost to employ staff members in another location is cheaper. There are often tax benefits for organizations that decide to offshore as well. Car manufacturing in a common example. Due to the cost of production, many of the cars that we drive in the United States are manufactured in another country.

Labor laws will be entirely different in another country, so there will be many new compliance requirements when offshoring. There will also be cultural and societal differences to consider that will greatly impact what changes are made and how they are made.

Divestitures

Rather than growing, some organizations make the decision to downsize in order to meet strategic or financial goals. A divestiture can happen through a sale of part or all of a company’s business. Sometimes, the decision to undertake a divestiture may come after a merger or acquisition. When two businesses merge and become fully operational, a certain business unit or location may be redundant or not perform as well financially as others.

Downsizing

During a divestiture, HR will generally be tasked with reducing staff, also known as a downsizing. Downsizing can happen even in the normal course of a budget cycle. If revenues are falling, expenses will have to fall as well. A very large expense is payroll. Thus, an immediate impact on budget reduction can be achieved by reducing payroll through downsizing.

Once the decision is made to reduce employees, a lot of planning and communication need to occur, such as the following:

•   Forecasting the right number of staff needed to operate the business and the number of staff to reduce.

•   Determining a method for staff reduction that does not violate any law or regulation, especially discrimination. How will the organization determine who stays and who does not? How will this change be executed in a fair and unbiased way?

•   Checking for other laws the organization may be subject to as a result of this change. A common one is the Worker Adjustment and Retraining Notification Act (WARN Act).

•   Creating a separation package for employees to assist with their transition out of the workplace.

•   Determining how to communicate this change to staff members being separated from the organization and staff members who are staying. Organizational changes can be extremely difficult for the employees who stay with the organization.

Many of these steps are handled at the senior HR level. However, a divestiture or any restructure involves tremendous HR support. You may find yourself assisting with this process by gathering data about employee performance, hire dates, or demographics to help select a method of staff reduction, or you might help develop new organization charts or assist in the preparation of separation packages for employees.

Furloughs

Instead of removing employees from the payroll, some organizations opt to use furloughs. A furlough is a temporary, unpaid leave of absence that is mandated by the employer. So, the worker is not actually removed from the payroll but is asked to take unpaid time off for a certain period of time instead. Time off may be required in a block leave, or a certain number of hours or days within a certain period of time. The main objective is to reduce payroll costs without actually terminating the affected employees.

Security Risks

In the modern American workplace, there are a lot of potential security risks. Just in the information services context, cyber-crimes have begun climbing the activity chart. Identifying the risks is a task that should be undertaken as part of the policy development process and procedural planning. The way to do that is to inspect each element of organizational operations and ask yourself what could go wrong, or what is exposed, and then develop your plans accordingly.

If your organization is large enough to enjoy the presence of a security department, you should expect those individuals will play a key role in all of the following planning, problem identification, and response implementation.

Data Security/Cyber-Crimes

Data security is critical for human resource professionals. Maintaining a viable HR data system (human resource information system, or HRIS) is important for employee, supervisor, and HR use. Having that access blocked is a serious issue. If it is blocked because of equipment problems, that is one set of problems. If it is blocked because of a cyber-attack from someone intending to do harm, that is a different set of problems. Planning for both is something HR professionals must contribute to and sometimes take the lead in managing. Often, when there is a staff of information service professionals, they will be key allies in the planning and response process. Working with law enforcement officials is another duty that must be assigned to someone in the organization. Supporting organizations that work to prevent cyber-crimes is a consideration for medium- to larger-sized employers.

Hacker Theft

What happens when someone hacks into the HRIS and gains access to personal information about employees? HRIS data includes Social Security numbers, home addresses, names and ages of dependents, employee banking information used for direct deposit, and more. When an unauthorized person gains access to that level of sensitive data, there needs to be a rapid response to help employees protect themselves and their families. One type of support is to sponsor coverage by an organization such as the Equifax credit protection service or the LifeLock identity theft protection service. There are many such services in the marketplace. You can get advice about selecting such support from your chief financial officer and legal adviser.

A relatively new problem in the area of cyber-crime is the problem of hackers holding your data hostage. They corrupt your computer so that you cannot access or retrieve your data if you don’t agree to pay them a fee to unlock your computer. This is emerging as a serious threat to employers. What if you pay and the hackers don’t unlock your computer? What if you don’t pay and your computer is suddenly worthless? What backup practices do you have for ensuring you can re-create your computer on a different machine with all the current data should that be necessary? Cyber-criminals are becoming very creative in their methods of attack. Almost always, their nastiness is aimed at ways they can extract money from employers for the release of the employers’ information.

Employee Cyber-Theft

Disgruntled employees sometimes head for the company’s databases with an eye to stealing proprietary information on products or services. They also can seek out access to employee data from payroll systems or the HRIS. You can imagine all the bad things they could do with such data if they got it. An HR professional’s first duty is to plan for such problems and create plans to prevent them from happening. The second duty is to determine how to respond once a theft has occurred. Human resources normally plays a lead role in planning and implementing these plans and policies.

Inventory and Supply Security

Large organizations usually have large quantities of raw materials and completed product on hand. They also have large quantities of supplies used for office functions, medical support, employee comfort, and safety. Small organizations don’t have nearly the same levels of inventory, but what they have is precious to them and a financial hardship if these supplies should go missing.

HR professionals need to work with operations managers and supervisors who have primary oversight of raw materials and product inventories and identify the risks they face and how those risks can be mitigated. Then, attention should be paid to how the organization will respond if such a theft should occur. What law enforcement will be needed? What, if any, public announcements should be made and by whom within the company?

Equipment Security

Equipment is expensive. Human resource department computer equipment expands with the size of the organization. The more there is, the greater the investment that must be made to replace the equipment should it be stolen. Many years ago, a human resource consulting firm was the victim of vandals who broke into their offices and removed every computer they had. The criminals were in and out of the facility so fast that no one saw them, and they didn’t appear on any video surveillance recording because the firm didn’t have any cameras installed. The data was lost. There were no backups. The firm nearly went out of business because of that theft. You can protect your organization from such a disaster if you think ahead to what you would face if someone stole your computers or other essential equipment. How can you protect that equipment? How can you prevent such a theft? What will be your recovery plan if you do experience such an attack?

Theft Prevention/Loss Prevention

In large organizations, entire departments are given the responsibility of preventing loss. There is “shrinkage” of inventory caused by shoplifting and employee theft. There is loss of money from bank accounts due to embezzlement. If it is an asset to the business, it can be stolen. HR professionals have roles to play in loss prevention, whether or not there is an independent department assigned to address those issues.

Employee Theft

Pilfering from the petty cash box in the office manager’s desk drawer or diverting customer payments to personal accounts rather than company accounts are both examples of employee theft. In retail establishments, employee theft of products can be an issue.

When individuals have a predilection for stealing, they likely have a record showing they have been in trouble for such behavior in the past. Background checks should be able to unveil the record so it can be assessed and the job candidate rejected from further consideration if that is appropriate. To do that, the historical problem should be relevant to the job in question. If the job involves handling inventory, cash, or financial records, and the background shows convictions for grand theft, that might qualify as a rejection reason.

Customer Theft

Customer theft can involve a “five-finger discount” taken as the customer cruises the aisles of the employer’s store. Shoplifting is America’s number-one property crime according to pricegun.com.⁸ On average, there are 550,000 shoplifting incidents every day. They total $13 billion of loss each year, representing a daily loss of $35 million. That is significant reason for employers to address customer theft issues.

HR professionals are involved with policy development and implementation to prevent theft in coordination with operations departments and other staff organizations. The tasks HR people may be involved with can include investigation of complaints about management treatment, investigation of policy violations, and training for employees on policy requirements.

Preventing Equipment Damage

One would normally think that preventing equipment damage falls to the operations groups that use the equipment. Yet, when arguments turn nasty, employees can resort to sabotage. Sabotage means deliberately destroying something so it will not work; the word comes from a century-old employee grievance over employer treatment (literally, throwing a shoe, or sabot in French, into the machinery to cause damage or failure of the equipment).

HR professionals can play a preventative role by properly training employees in requirements of organizational policies and investigating employee complaints of unfair or illegal treatment. Feedback to the complaining employee is critical so the communication cycle is fulfilled. The complaining employee must learn what has resulted from the complaint. Without that feedback, employee trust in the employer’s handling of the issue without bias will diminish substantially.

Securing Passwords

HR professionals can help the organization with securing passwords by reviewing and training employees on the policy requirements. HR can also maintain a master log of passwords issued to each employee for the software access each person needs. If there is an information technology department, that log can be kept by the computer professionals. Preventing people from using sticky notes to write passwords and sticking them onto computer screens is important. Putting passwords on a list taped to the “breadboard” pull-out tray on a desk is also unacceptable. HR can help organizational groups determine the proper method for securing passwords for the employer.

Terrorism

Hardly a day goes by without a news story about terrorism somewhere in the world. Workplace violence is sometimes a result of terrorism and sometimes a result of disgruntled workers. It is obvious that terrorism can sometimes result in harm to employees and sometimes in loss of property. A key method for identifying situations that can involve terrorism is through employee involvement. Employee alerts to a central processing group (text message, voice call, or e-mail message) can start the wheels turning to respond and save injury and damage. Training employees in the policies for handling such incidents and how to report them is often an HR responsibility.

Workers’ Compensation Compliance

The world of workers’ compensation insurance is tightly regulated by state governments. States govern reporting of workplace accidents and follow the treatment for each injured worker from beginning to end. Workers’ compensation insurance dictates how much will be paid for treatment and for how long. Yet there are some decisions employers get to make about their involvement with workers’ compensation cases.

Reporting Requirements

Workers’ compensation insurance procedures specify what information must be transmitted to the insurance company for an employer with a workplace accident. Also, these procedures specify what administrative information must be sent periodically, along with medical treatment reports. HR professionals are usually tasked with the responsibility to monitor case reports and be sure everything the insurance carrier needs actually gets to them.

Return-to-Work Policies

You might not immediately think there are policy latitudes available to employers in the handling of workers’ compensation issues. Yet return-to-work policies are a good example of how employers get to determine certain employee-handling questions.

It is almost never up to the employer how early someone can return to work. That is governed by the medical evaluators. However, employers can overlay policies about the conditions under which a person can return to work.

Modified-Duty Assignments

Some people believe that modified-duty assignments are required by workers’ compensation rules if there are medical restrictions when an employee is ready to return to work. In fact, employers can determine their own policy about their ability to have someone working with restrictions. That policy may vary by job type and the restrictions specified by the workers’ compensation medical determinations.

If someone is going to return to work from a skiing accident with the restriction that they may not carry more than 10 pounds because of a broken leg that is still in a cast, for example, the employer gets to say whether it can have someone on the job with those restrictions. If it is not possible to have the employee lift only 10 pounds in a shipping and receiving job, it is permissible for the employer to delay the worker’s return until no restrictions are required.

Likewise, if the medical restriction involves working only a few hours each day, the employer gets to determine whether it can use someone on the specific job assignment for less than full time each day.

Any decisions about these return-to-work issues should be properly documented to show both the decision and why that decision was the best for the circumstances. Employers may not arbitrarily block someone from returning to work without a legitimate business explanation.

Reasonable Accommodation

Reasonable accommodation in workers’ compensation cases involves the same obligations that any other job accommodation request would impose on the employer. The employer must be willing to engage in an interactive dialogue process with the employee about the medical restrictions and how the job can be performed with those restrictions.

Safety is one reason for rejecting a job accommodation request. Return-to-work decisions must provide for the safe performance of job duties. If it is not possible for an injured worker to perform the job without significant safety risks, the employer may be justified in delaying the return to work by rejecting the job accommodation request.

Independent Medical Exam

Often the medical advisers on which a workers’ compensation case will rely are those hired by the insurance carrier. At any time, the employer and/or the employee can choose to involve different medical people for additional opinions. Those involvements will come at the expense of the party requesting the additional opinion. When medical opinions clash, a decision must be made with concurrence of the workers’ compensation insurance carrier, the employer, and the employee.

When an employee doesn’t want to return to work under conditions specified by the medical experts, it may be that progressive discipline is the appropriate avenue for resolving the disagreement.

Documentation by the HR organization will be essential in case the employee decides to contest their treatment in court. Entry-level HR professionals play a key role in that documentation process, if not by writing it then by ensuring that appropriate parties submit it for the case file.

OSHA Compliance

Federal safety and health laws and regulations begin to impact an employer once the first employee is hired. The Occupational Safety and Health Act contains a General Duty Clause that requires employers to provide safe and healthy working conditions. That duty involves proper observation of workplace safety conditions and correction of any problems identified.

Workplace Safety Inspections

Larger employers have organizations that care for safety issues in all organizational units. Even though a safety department may exist, it is still incumbent upon supervisors, managers, and HR professionals to support safety rules and policies.

In smaller organizations, it may be the HR professional in concert with line supervisors who will handle safety monitoring and reporting tasks. Conducting inspections using a documentation tool such as the one shown earlier in Figure 7-1 can be helpful to document the safety status of your workplace.

Accident Reporting

Depending on your organizational size, you may have specific requirements for reporting accidents to OSHA. Even if you have only one person on the payroll, you will have reporting requirements under your workers’ compensation insurance policy.

For detailed instructions about OSHA injury-reporting requirements, you should visit the agency’s web site at https://www.osha.gov/recordkeeping/RKforms.html. Any changes the agency might make in the future will be posted on the web site as soon as they are approved for use. Make a habit of checking the site often.

Accidents that require only first aid are not reportable under OSHA regulations. You must identify your company’s policy to determine how you should report such incidents internally. According to OSHA,⁹ first aid “often consists of a one-time, short-term treatment and requires little technology or training to administer. First aid can include cleaning minor cuts, scrapes, or scratches; treating a minor burn; applying bandages and dressings; the use of non-prescription medicine; draining blisters; removing debris from the eyes; massage; and drinking fluids to relieve heat stress.”

OSHA defines a recordable injury or illness as follows:¹⁰

•   Any work-related fatality.

•   Any work-related injury or illness that results in loss of consciousness, days away from work, restricted work, or transfer to another job.

•   Any work-related injury or illness requiring medical treatment beyond first aid.

•   Any work-related diagnosed case of cancer, chronic irreversible diseases, fractured or cracked bones or teeth, or punctured eardrums.

•   There are also special recording criteria for work-related cases involving needlesticks and sharps injuries, medical removal, hearing loss, and tuberculosis.

It can be helpful to prepare a reference list showing your reporting requirements to refer to should there be an accident with one of your workers. It could look like Figure 7-2.

Figure 7-2  Employee Injury Reporting Contacts

You should customize Figure 7-2 for your organizational policies and expectations. The priority of contact points should be resequenced for your employer. It may be that management wants notification before the workers’ compensation insurance company is called. Make this tool fit your requirements. It is better to get these questions answered in advance of any actual injury and a need to use the list.

Incident Reports

OSHA has a series of forms that are important for tracking injuries and illnesses and then summarizing the totals at the end of each year. OSHA Form 301, Injury and Illness Incident Report, is used to document a reportable injury. It asks for basic information such as name, address, birth date, hire date, who the tending medical provider was, what happened, and what the employee was doing just before getting injured. Current requirements call for retaining each of these incident reports for a minimum of 5 years.

Annual Accident Summary

At the end of each calendar year, employers with ten or more people on the payroll must prepare summary reports called OSHA Form 300 and OSHA Form 300A. These forms contain information about the number of days of work lost because of the accident and the number of days that the employee was on restricted duty or in a different job assignment while recovering. OSHA Form 300 is, in essence, a log of accidents that have happened during the year. This log must be summarized and documented on OSHA Form 300A. It is the summary form (OSHA Form 300A) that must be posted in a conspicuous location within the workplace from February 1 to April 30 each year. This summary does not have any personally identifiable information on it. That is all on the log (OSHA Form 300), which does not need to be posted. Form 300A must be retained for a minimum of 5 years.

Chapter Review

This chapter covered the importance of compliance, safety, and security issues. Employers are governed by many federal laws in these areas. Those laws require certain documentation and reporting of events. Some organizations also employ workers represented by unions, resulting in additional compliance requirements. You also saw how advanced planning can help prevent workplace accidents and improve workforce restructuring processes. New developments in the area of cyber-theft and network hacking are becoming more important to HR professionals. There are many tasks involved with these facets of HR management. Understanding the impact they have on your organization and its workers is critical to all HR professionals.

Questions

Select the single best answer for each of the following questions.

1.   The ABC Company has 200 employees and needs to close one of its plants, which will cause a large number of employees to lose their jobs. Which federal law is most important for ABC Company to review in this situation?

A.   MSHA

B.   OSHA

C.   FLSA

D.   WARN

2.   In an insurance company, there are few employee hazards according to its HR manager. In fact, the HR manager believes there are no federal laws that will impact safety in its operations. As the associate HR manager, what recommendation would you make to your boss?

A.   Stay the course. The HR manager is right about the freedom from federal oversight.

B.   Reconsider the conclusion. Federal oversight and office safety laws say that the employer must conduct safety training for all employees.

C.   Stay the course. The employer is specifically exempt. All insurance companies are excluded from coverage under federal safety laws.

D.   Reconsider the conclusion. OSHA requires all employers to provide a safe workplace in compliance with the General Duty Clause.

3.   HIPAA does not apply to which of the following?

A.   Health plans

B.   A chiropractor who has retired and sold the practice

C.   A healthcare provider that sends medical records electronically

D.   A healthcare provider that keeps paper copies of medical records

4.   Morton is your colleague and another Associate Professional in Human Resources. He is wondering if someone who has diabetes under control by using insulin should be considered disabled. What is your advice?

A.   Absolutely not. When a disabling condition is controlled by medication, it is no longer considered a disability.

B.   When the disability is controlled with only limited insulin injections, it is no longer considered a disability.

C.   Even if it is controlled by insulin, diabetes is still considered a disability under the ADA.

D.   Unless the diabetes has been treated for more than 5 years, it is not considered a disability.

5.   The Family and Medical Leave Act will apply to which of the following employees?

A.   A new father wanting to take time off for bonding with his new son

B.   An uncle who wants to travel to the “old country” to see his new niece

C.   A mother who wants to take more time off following her vacation

D.   A sister wanting to surprise her brother for his 50th birthday

6.   In which of the following instances is an injury and illness prevention plan a tool for improving safety?

A.   When a company receives a letter from OSHA saying it will soon be inspected

B.   When an employer wants to cover up hazards that have been bothering people for years

C.   When a company wants to communicate with its employees the procedures for handling certain hazards

D.   When personal protective devices are sent out for repair

7.   IIPPs have been shown to:

A.   Reduce illness and injury in the workplace

B.   Improve the décor of any modern-day office

C.   Reduce the paperwork associated with injury reports to the government

D.   Increase the amount of supervisor interventions when janitorial staff performance problems arise

8.   Workplace hazards are best identified through which of the following methods?

A.   Having a working committee to discuss the problems they see

B.   Conducting periodic inspections of each work location and documenting the issues identified as potential hazards

C.   Logging the accidents that employees have

D.   Employee suggestions for fixing problems they see at their workstation

9.   One hazard common to all work locations is fire. Consequently, an evacuation plan should be developed and included within which of the following documents?

A.   Material Safety Data Sheets

B.   Worker’s Compensation manual

C.   Injury and illness prevention plan

D.   Spreadsheet of employee problems that should be addressed

10.   Workplace violence is something that most employers:

A.   Won’t have to worry about

B.   Will address through the IIPP

C.   Should downplay to prevent any self-fulfilling prophecies

D.   Can prevent if they keep their doors locked

11.   Which of the following is not considered a security risk?

A.   Employees who have a worsening attendance problem

B.   Customers who insist on seeing the way their products are assembled

C.   Retail stock that is close to an entry or exit

D.   Managers who travel with laptops containing company databases

12.   What should you do if you receive an anonymous tip that one of the company employees is stealing employee data for identify theft purposes?

A.   Call the police and let them handle it.

B.   Confront the employee to get their reaction.

C.   Notify senior management and begin an investigation.

D.   Dismiss it as an unfounded story.

13.   What should HR do when an employee is injured at work?

A.   Notify the proper federal and state demographic agencies.

B.   Notify the bank that there will be more workers’ compensation checks needed.

C.   Notify the workers’ compensation insurance carrier.

D.   Notify the parent company.

14.   When an employee’s doctor releases the employee to return to work with restrictions, what should happen?

A.   The employer must take the employee back and find a way to accommodate the restrictions.

B.   The employer can determine whether there is a way to accommodate the restrictions.

C.   The employer is obligated to return the employee to the same job without doing all the heavy lifting.

D.   The employer is required to pay the employee the normal rate even if there is no job available with the required restrictions.

15.   An employee is ready to return to work with restrictions lasting 8 months specified by their doctor. What must the employer do?

A.   Make a job available that matches the restrictions for the entire 8 months.

B.   Pay the employee at the old earnings rate, even though the restrictions mean working at a lower-paid level.

C.   Give up to a full year of restricted-duty assignment to any worker injured on the job.

D.   Determine whether it is possible to keep the employee working with restrictions for that long a period. If it isn’t, the employer may choose not to return the employee to work.

16.   All employers are subject to OSHA regulations:

A.   As long as they have ten people on the payroll

B.   If they engage in interstate commerce

C.   Regardless of the number of employees

D.   Whenever state regulations don’t predominate

17.   How does OSHA classify an injury at work when the injury is treated with a bandage?

A.   A reportable serious injury

B.   A non-reportable serious injury

C.   A non-reportable first-aid injury

D.   A reportable first-aid injury

18.   What does OSHA says you should do when someone is stuck by a syringe needle accidentally?

A.   Report the case under OSHA rules.

B.   Save the reporting until the end of the calendar year for the summary report.

C.   Report the case as a minor incident that didn’t require medical treatment.

D.   Ignore the needlestick. It isn’t covered.

19.   When must the year-end OSHA summary report be posted?

A.   From January 1 through March 31

B.   From February 1 through April 30

C.   From March 1 through May 30

D.   From April 1 through June 30

20.   You and your coworker are having a debate about your union’s collective bargaining agreement (CBA). You think CBAs are contracts between a union and an employer, but your coworker disagrees. Which of the following is the best answer?

A.   You’re right. They are written expressions of a set of workplace rules and benefits the employer will provide in exchange for employee work performance.

B.   You’re wrong. They are guidelines only. The union will work out any deviations in the grievance process.

C.   You’re both right. If the agreement says it is a contract, then it is a contract. If it doesn’t claim to be a contract, then it isn’t.

D.   It depends. If the employer tells the union it isn’t going to enter into a contract, then the agreement is only an informal set of working rules.

Answers

1.   D. The Worker Adjustment and Retraining Notification Act (WARN Act) applies to organizations with 100 or more employees and requires notification and pay protections for employees impacted by a mass layoff.

2.   D. OSHA’s General Duty Clause requires all employers to offer employees a safe and healthy work environment.

3.   B. Since the chiropractor has sold their practice to a new owner, responsibilities for record privacy transfer to the new owner and HIPAA would not apply.

4.   C. Mitigating treatment used to eliminate disability status, but not anymore. When it was amended in 2008, the ADA rules stated that mitigations may not be considered in determining disability status.

5.   A. Time for bonding with a new child is a qualifying event under FMLA.

6.   C. IIPP is a tool for communicating hazards and the means for handling them in the workplace. It should address the specific workplace in question.

7.   A. After requiring IIPPs, states such as Alaska, California, Hawaii, North Dakota, Texas, and Washington reported double-digit decreases in workplaces injuries and illnesses.

8.   B. When supervisors make inspections and record hazardous conditions, they have a record of actions necessary to make the workplace safer. Repair and improvement can be noted in future inspections.

9.   C. Every IIPP should contain an evacuation plan and directions for reassembly outside the facility so it can be determined whether everyone evacuated successfully.

10.   B. Both internal and external workplace violence possibilities should be addressed in the IIPP, along with the employee training plans for dealing with them.

11.   A. Employee attendance records have no correlation to security risks.

12.   C. Even though the allegation is from an anonymous source, you should discuss it with senior management and, with their approval, begin an investigation to determine whether there is any truth to the story.

13.   C. The workers’ compensation insurance carrier will open a case file and begin the process of managing examination, medical treatment, and recovery details.

14.   B. The employer must evaluate the restrictions and determine whether it is possible to accommodate the employee given their performance limitations.

15.   D. The employer must evaluate and document its efforts to identify a placement opportunity for that duration, but it is not obligated to create a job for the restricted employee.

16.   C. OSHA rules apply to all employers. Sometimes states contract with OSHA to perform the same functions in OSHA’s place.

17.   C. First-aid treatment is a non-reportable event under OSHA rules.

18.   A. OSHA calls needlesticks reportable injuries under special recording criteria.

19.   B. The summary report must be posted for 90 days from February 1 through April 30 each year.

20.   A. Collective bargaining agreements are contracts between the union and the employer.

Endnotes

1.   U.S. Equal Employment Opportunity Commission, “EEOC Releases Fiscal Year 2020 Enforcement and Litigation Data,” accessed on November 10, 2021, https://www.eeoc.gov/newsroom/eeoc-releases-fiscal-year-2020-enforcement-and-litigation-data

2.   U.S. Department of Labor, “Summary of the Major Laws of the Department of Labor,” accessed on November 10, 2021, https://www.dol.gov/general/aboutdol/majorlaws

3.   U.S. Department of Labor, “Civil Money Penalty Inflation Adjustments,” accessed on November 10, 2021, https://www.dol.gov/agencies/whd/resources/penalties

4.   Occupational Safety and Health Administration, “Safety and Health Programs in the States White Paper,” accessed on November 15, 2021, https://www.osha.gov/sites/default/files/Safety_and_Health_Programs_in_the_States_White_Paper.pdf

5.   Jay C. Beighley, CPP, War in the Workplace: A Practical Guide to a Safer Workplace (The Management Advantage, Inc., 2016)

6.   Accenture, “Continuity in Crisis: How to Run Effective Business Services during COVID-19,” accessed on November 15, 2021, https://www.accenture.com/us-en/insights/operations/coronavirus-effective-business-operations

7.   C.M. Christensen et al., “The Big Idea: The New M&A Playbook,” Harvard Business Review, March 2011

8.   Price Gun Store, “Shoplifting Is America’s #1 Property Crime,” accessed on November 15, 2021, https://www.pricegun.com/shoplifting-is-americas-1-property-crime/

9.   Occupational Safety and Health Administration, “Medical and First Aid,” accessed on November 15, 2021, https://www.osha.gov/medical-first-aid/recognition

10.   Occupational Safety and Health Administration, “OSHA Injury and Illness Recordkeeping and Reporting Requirements,” accessed on November 15, 2021, https://www.osha.gov/recordkeeping/